Slide 1

Alexey A. Didyk Kherson national technical university, Ukraine E-mail: adidyk@mail.ru Slide 2 Problem of intrusions/anomalies detection is important component of information security. Intrusions/anomalies detection is a process of identification of computing or network activity which is malicious or unauthorized. Therefore, revealing of the set of informative characteristics for detection of abnormal network activity is top priority problem for solving of the task of computer system protection from unauthorized intrusions. Slide 3 The idea is to examine if the multifractal properties of network traffic with some attacks differ from multifractal properties of normal traffic Slide 4 Fractal is a structure (set) consisting of parts, which in any sense are similar to the whole. It is well known that the geometrical complexity of a fractal set may be described, at least in a global way, by giving its dimension. The fractal (Haussdorff) dimension D measures the degree of irregularity or roughness of a set. Fractal is a set which Haussdorff dimension is strict more than its topological dimension. Slide 5 Multifractal is a certain association of various homogeneous fractal subsets of initial set, each of which has own value of fractal (Haussdorff) dimension. Multifractal spectrum (multifractal singularity spectrum) represents Haussdorff dimensions spectrum of homogeneous fractal subsets into which it is possible to break initial set. Multifractal analysis is concerned with describing the local singular behavior of measures, distributions, or functions in a geometrical and statistical fashion. Slide 6 This dataset is a version of the 1999 DARPA intrusion detection evaluation dataset generated and managed by MIT Lincoln Labs. This data represents both normal and abnormal information collected in a test network, in which simulated attacks were performed. Number of packets parameter was selected to obtain multifractal characteristics of network traffic. This parameter was sampled each second (i.e. number of packets per second), using tcpstat. Slide 7 Multifractal spectrum of NORMAL (LEFT) and ABNORMAL (RIGHT) network traffic Slide 8 multifractal spectrums of two sorts of network traffic have differences multifractal formalism can be used for analysis of network traffic for purpose of revealing of abnormal network activity multifractal spectrum can be used as express diagnostic tool for comparative analysis of network traffic structure Slide 9 Alexey Didyk E-mail: adidyk@mail.ru